Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Lazarix
Lazarix
Communicator
Member since:
06-28-2012
06-05-2020
Community Statistics
| Posts | 83 |
| Solutions | 7 |
| Karma Given | 4 |
| Karma Received | 10 |
| Member Since | 06-28-2012 |
Activity Feed
- Got Karma for Re: Can we install a universal forwarder on a 2016 Windows server with SCCM?. 06-05-2020 12:49 AM
- Got Karma for Splunk App for Web Analytics: http_user_agent missing for browsers in compatibility mode. 06-05-2020 12:48 AM
- Karma Re: TypeError: %d format: a number is required, not str for InterMapper. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk DB Connect 2: Why am I getting a JDBC connection error trying to connect to a DB2 database on ZOS?. 06-05-2020 12:47 AM
- Karma Re: Wrapping TimeRangePicker around DB Connector for Dan. 06-05-2020 12:46 AM
- Karma Re: Radial Gauge - show zero when no results found for alacercogitatus. 06-05-2020 12:46 AM
- Karma Re: Geostat remove "OTHER" for xisura. 06-05-2020 12:46 AM
- Got Karma for Re: iplocation command not returning lat/lon fields (with allfields=true). 06-05-2020 12:46 AM
- Got Karma for Re: iplocation geostats show count of events from source ip on Google map. 06-05-2020 12:46 AM
- Got Karma for Re: iplocation geostats show count of events from source ip on Google map. 06-05-2020 12:46 AM
- Got Karma for Re: iplocation geostats show count of events from source ip on Google map. 06-05-2020 12:46 AM
- Got Karma for dbquery show database name in results. 06-05-2020 12:46 AM
- Got Karma for Splunk bootstrap themes. 06-05-2020 12:46 AM
- Posted Re: How do you solve a problem like Json on Getting Data In. 02-15-2019 09:23 AM
- Posted Re: How do you solve a problem like Json on Getting Data In. 01-24-2019 02:53 AM
- Posted Re: How do you solve a problem like Json on Getting Data In. 01-24-2019 02:49 AM
- Posted Re: How do you solve a problem like Json on Getting Data In. 01-24-2019 02:48 AM
- Posted How do you solve a problem like Json on Getting Data In. 01-24-2019 01:57 AM
- Tagged How do you solve a problem like Json on Getting Data In. 01-24-2019 01:57 AM
- Posted Re: ODBC connection problem with Splunk ES on Splunk Enterprise Security. 09-02-2018 03:47 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
02-15-2019
09:23 AM
This does exactly as expected!
Thank you so much.
I'm starting to get a better appreciation for json now, just wish it were easier to search on in splunk
... View more
01-24-2019
02:53 AM
Thanks for the information Frank.
I've uploaded an example of the json here:
https://gist.github.com/IanMoroney/34369128701f67ce0a1b159332356665
I understand the approach around atomic data points, and I agree that splunk is more suited to that. I suppose i wouldn't expect to be forced to flatten a structured relational data source in order to read it, as the associations are contained within the structure.
but, you live and learn!
... View more
01-24-2019
02:49 AM
As mentioned in the question, yes i did and I also tried combinations of spath and mvexpand.
... View more
01-24-2019
02:48 AM
https://gist.github.com/IanMoroney/34369128701f67ce0a1b159332356665
... View more
01-24-2019
01:57 AM
I'm having serious issues in Splunk related to searching Json structures.
I really don't understand why Json isn't easier to search, considering that Splunk recognises the structure and allows you to expand it in syntax highlighted mode.
The issue that i'm having is that it appears to be impossible to search for a simple table of
value.data.timestamp value.name.localizedValue value.data.count
ultimately across multiple value.name.localizedValue entries, in order to try and do a timechart that shows metrics over time, or to be able to use this data inside ITSI as metrics for KPIs.
Above is one expanded data node, of which inside this value node, there are multiple data nodes each with this structure. Each data node contains one type of name.localizedValue (effectively the metric name).
I have tried, unsuccessfully, to use spath and mvexpand (admittantly, i don't fully understand these commands, and how they are used to their best effect) and I can't get them to format the data in the way i want to display it. But at the same time, why should we have to put over 500 characters into a search bar in order to search this type of structured data?
If the solution is ultimately to flatten the data so that you can search it, why have json at all?
The way i'd expect to see the data is like:
Table:
| value.data.timestamp | value.name.localizedValue | value.data.count
| 2019-01-23T13:10:00Z | CPU Time | 15
| 2019-01-23T13:11:00Z | CPU Time | 16
As an aside, is there any way to make this process easier?
... View more
09-02-2018
03:47 PM
You may be able to solve this with Data Models in ES. You may need to make sure that the target ES data model is shared globally instead of just in the app.
You could also check to see if the saved searches you have in ES have their permissions set to global instead of just to App also, and that could solve your problem.
... View more
09-02-2018
03:37 PM
Follow This Guide on how to upgrade a cluster, with various options depending on your topology.
In future versions (but not applicable for this scenario), you will be able to perform Rolling Upgrades
... View more
09-02-2018
03:33 PM
Try this in props.conf:
[CatTools:Firewall:ASA-CLI]
SHOULD_LINEMERGE = false
BREAK_ONLY_BEFORE=gobbldegook
MAX_EVENTS=200000
LINE_BREAKER = ((*FAIL))
TRUNCATE=99999999
The break only before and line breaker above are set to something that should not match in the source file.
There is also a 500 line default for max events which we are bypassing above.
The result should be that the entire ASA config is imported as a single event.
... View more
09-02-2018
03:25 PM
SingleValues only work inside of an entire view XML module and include all the HTML that is generated.
You may need to use Sideview Utils to get what you want out of this particular situation, as the HTML probably won't let you do what you need.
... View more
09-02-2018
03:18 PM
Assuming it's linux, run this command on the host:
last
you can also search
/var/log/secure
for "sshd"
Additionally, the Splunk App for Unix extracts data from /var/log/secure and other such system level logs so you can consume that data in Splunk.
... View more
09-02-2018
03:12 PM
look for limits.conf
Configure:
[searchresults]
maxresultrows = 100000
... View more
09-02-2018
03:09 PM
I think you may need to stop bucketing the time spans in 10 minute increments.
If you have to bucket, try 1m instead of 10m
... View more
09-02-2018
03:06 PM
Can you post an example of:
The query you are running
The results that are returned
What you would actually like returned
An example for me is if I do the following:
index="_internal" clientip="*" info
I get data for splunkd_ui_access and splunkd_access logs.
When I search for:
index="_internal" clientip="*" "/services/server/info"
I instead just get info for the splunkd_access logs.
There are many ways to search for the specific data that you're looking for, but we'll need the context in order to help more 🙂
... View more
09-02-2018
02:57 PM
Best thing i've found in these situations is to add an empty panel, or two empty panels to the same row.
<panel>
<html>
<u1> </u1>
</html>
</panel>
Below is an image example of 1 row with a chart, and a second row with blank panels added along with the same chart.
... View more
09-02-2018
12:10 PM
Make sure that the ports listed in the Splunk Common Network Ports diagram are open in the way that they should be according to your cluster topology.
http://downloads.jordan2000.com/splunk/Splunk-Common-Network-Ports-v2.0.3.png
... View more
09-02-2018
12:08 PM
What does your topology look like for the cluster?
... View more
11-15-2017
01:07 AM
I've modified the regex slightly to remove the CRLF (technically it may miss the first event as it doesn't preceed a CRLF) and the pattern in a regex tester is matching correctly, but still exhibits the same behaviour:
https://www.regextester.com/?fam=99529
... View more
11-15-2017
12:46 AM
https://i.imgur.com/ufsAGkE.png
The common denominator is the fact that the "event break" as opposed to the "line break" (one would assume that they mean the same thing in this case) should always begin with <![LOG
In the screenshot you will see:
An event being correctly identified
An event being split before ]LOG]!>
Two events in the same event
... View more
11-14-2017
09:38 AM
Same issue as above when I try this config 😞
I wish it were possible to specify the beginning and the end of the event instead
... View more
11-14-2017
08:47 AM
It's not quite working 😕
my props.conf is:
[sccm]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=<!
... View more
11-14-2017
07:38 AM
Thanks!!
I'll give this a try now, wait for some events and let you know
... View more
11-14-2017
07:09 AM
Hi all,
I was hoping someone might be able to point me in the right direction for where to set this and how exactly to set it:
I'm consuming some logs from SCCM (log sample below for reference) and they have a distinct pattern for events and event breaks. I know that the regex that i would come up with is supposed to go into either props.conf or transforms.conf but I don't know which.
Sample events:
<![LOG[Active enforcement task with MTC Id a1c5be10-73fe-4d8a-b745-862c63a44faf not found]LOG]!><time="18:31:43.760+00" date="11-12-2017" component="CITaskMgr" context="" type="1" thread="37360" file="ccitaskmgr.cpp:1054">
<![LOG[Release task Enforce for CI ScopeId_7FFCE0E9-58B7-4E0C-8322-5704CF6E0B26/DeploymentType_bbb6820e-f332-4550-91a6-12344b4ed081.3 for target: , consumer {3FC6019A-45DB-4D07-9F1D-E19A7F509482}]LOG]!><time="18:31:43.838+00" date="11-12-2017" component="CITaskMgr" context="" type="1" thread="30416" file="ccitaskmgr.cpp:405">
<![LOG[Release task Enforce for CI ScopeId_7FFCE0E9-58B7-4E0C-8322-5704CF6E0B26/Application_63222d92-85cb-40bd-850a-1f1264d1302c.3 for target: , consumer {E6682089-51BE-4F27-A576-753A8D2B5EF8}]LOG]!><time="18:31:43.838+00" date="11-12-2017" component="CITaskMgr" context="" type="1" thread="30416" file="ccitaskmgr.cpp:405">
<![LOG[Release task Enforce for CI ScopeId_7FFCE0E9-58B7-4E0C-8322-5704CF6E0B26/RequiredApplication_63222d92-85cb-40bd-850a-1f1264d1302c.3 for target: , consumer {901FBA32-A63D-4172-94FA-5C31054BF474}]LOG]!><time="18:31:43.838+00" date="11-12-2017" component="CITaskMgr" context="" type="1" thread="30416" file="ccitaskmgr.cpp:405">
As you can see from the sample above:
Each event "header" starts with <![LOG[ and ends with ]LOG]!>
Each event "detail" starts with < and ends with > and is always preceded by the "header" before it.
So effectively, it's <![LOG[headerhere]LOG]!><detailhere>
My thought was to do a single event as <![LOG[headerhere]LOG]!><detailhere> and from there I could do field extractions for the "header text" and each part of the detail (where something=somethingelse).
Assuming I do the field extractions within splunk instead of props.conf/transforms.conf (best practice now), how should I do the event break?
Should I do something where "the end of every event is "> " and set that as the props.conf LINE_BREAKER ?
Are there any other considerations that I should be aware of, such as SHOULD_LINEMERGE or other things?
Many thanks
... View more
11-13-2017
08:30 AM
1 Karma
I have done this with SCCM so yes it is very possible.
Splunk Package with:
"This package contains source files". Put said source files on a network location and point the data source to the source folder.
Put the following in this folder:
splunkforwarder--x64-release.msi
install_splunk.bat
org_all_deploymentclient (this is a folder)
inside org_all_deploymentclient, put the following structure:
org_all_deploymentclient
--- local
---- app.conf
---- deploymentclient.conf
---- outputs.conf
inside app.conf:
[install]
state = enabled
[package]
check_for_updates = false
[ui]
is_visible = false
is_manageable = false
inside deploymentclient.conf:
[deployment-client]
clientName=$HOSTNAME
[target-broker:deploymentServer]
# Change the targetUri
targetUri = <fqdn to your deploymentserver>
inside outputs.conf:
[tcpout:server]
server=<fqdn to indexer>:<port>
Once you have this Package created, create a Program:
Name: SplunkUF (name it whatever you want)
command line: install_splunk.bat
Run: hidden
After running: no action required
Program can run: whether or not a user is logged on
inside install_splunk.bat:
msiexec.exe /i "splunkforwarder-<splunkversion>-x64-release.msi" LAUNCHSPLUNK=0 AGREETOLICENSE=Yes INSTALLDIR="%ProgramFiles%\SplunkUniversalForwarder" SERVICESTARTTYPE=auto /quiet
xcopy "org_all_deploymentclient\*.conf" "%ProgramFiles%\SplunkUniversalForwarder\etc\system\" /s /e /i /y
for /F "tokens=3 delims=: " %%H in ('sc query "SplunkForwarder" ^| findstr " STATE"') do (
if /I "%%H" NEQ "RUNNING" (
net start "SplunkForwarder"
)
)
the second part of the script which starts the service if it isn't running is useful for upgrades, in case the service doesn't start.
... View more
08-24-2016
12:15 PM
I've re-installed the app and set it up from default and the data is now working again. Browsers still showing up as unknown for those working in compatibility mode.
I've updated the UA-Parser from the github link, but no change.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
